AWS Secuirty in AWS RDS

1 min read

Encryption and Encoding

Encryption in transit: accomplished with SSL/TLS connection between client and RDS instance, can be mandatory.

Encryption at rest: AWS RDS supports EBS AWS KMS encryption1, with either AWS managed keys or Customer managed keys. Data key (DEK) is used for encryption operations.
Encryption cannot be removed!

Elements which being encrypted:

  • Storage
  • Logs
  • Snaphots
  • replicas

MSSQL and Oracle support TDE2, in addition latter supports TDE with AWS Cloud-HSM meaning no key exposure to AWS.

AWS IAM (Authentication only)

For IAM access an RDS local DB would require a local user configured to use AWS Authentication Token. Next, IAM Instance Profile with necessary permissions and users is attached to a RDS instance, hence mapping user to a RDS local DB user.

generate-db-auth-token operation is used to generate 15 minute validity token which is used in place of password a DB user’s password.

Footnotes

  1. done by the RDS HOST itself ↩

  2. transparent data encryption – data is encrypted and decrypted by the DB engine itself. ↩

Graph View